Privacy Policy & GDPR Data Processing Notice

1. Data Controller & Processor Roles (GDPR Art. 28)

Billaily (billaily.com) is operated by Peakbask, MB, registered in Vilnius, Republic of Lithuania (European Union).

• Landlord Account Data (Controller): For property managers and landlords who register an account on billaily.com, Peakbask, MB acts as the Data Controller for account credentials, organization billing details, and subscription invoices.
• Tenant & Utility Invoice Data (Data Processor): For apartment unit records, tenant names, tenant email addresses, lease dates, and utility provider PDF invoices uploaded by a landlord, the Landlord is the Data Controller (processing under GDPR Art. 6(1)(b) performance of a tenancy contract) and Peakbask, MB acts strictly as the Data Processor on the Landlord's instructions.

2. Categories of Data Processed

• Account & Billing Data: Work email address, organization name, active door count, and Stripe payment identifiers (credit card numbers are processed directly by Stripe and never stored on Billaily servers).
• Property & Utility Ledger Data: Building street addresses, apartment door numbers, floor areas (m²), utility meter serial numbers, customer codes, and uploaded utility provider PDF/image invoices.
• Tenancy Statement Data: Tenant name, optional tenant email address, move-in/move-out dates, prorated utility charges, running balance (arrears or credit), and bank transfer confirmation references.

3. Tenant Isolation & Database Security

Every organization's buildings, apartment units, meters, tenancies, and utility invoices are isolated in PostgreSQL 16 using Row-Level Security (RLS) scoped by organization_id. Uploaded utility PDFs are never used to train public AI models and are accessible only to the owning portfolio workspace and the specific tenant statement link (/t/[magic_link_token]) generated for that unit.

4. Sub-Processors & Data Deletion Rights

We use a minimal set of infrastructure sub-processors: PostgreSQL database hosting (EU), Vercel (application edge delivery), Stripe (subscription billing), Resend (transactional magic-link and statement emails), and Google Cloud Gemini API (automated structured field extraction from utility invoices).

Landlords can delete any apartment unit, tenant record, or entire workspace directly inside the dashboard at any time, or request full account erasure and a signed GDPR Data Processing Addendum (DPA) by contacting hello@billaily.com.